chore: linting

.github/workflows/codeql.yml

@@ -1,13 +1,7 @@
 name: "CodeQL"
 
 on:
-  workflow_call:
-    inputs:
-      checkout_ref:
-        description: Optional commit to check out instead of the triggering ref
-        required: false
-        type: string
-        default: ""
+  workflow_call: {}
   push:
     branches: ["main"]
   pull_request:
@@ -38,8 +32,6 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
-        with:
-          ref: ${{ inputs.checkout_ref }}
 
       - name: Set up pnpm package manager
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9

.github/workflows/dependabot-automerge.yml

@@ -10,66 +10,12 @@ permissions:
   checks: read
 
 jobs:
-  security-scan:
-    name: Security Vulnerability Scan
-    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" # v2.3.8
-    with:
-      scan-args: |-
-        -r
-        --skip-git
-        --lockfile=pnpm-lock.yaml
-        --lockfile=src-tauri/Cargo.lock
-        ./
-    permissions:
-      security-events: write
-      contents: read
-      actions: read
-
-  lint-js:
-    name: Lint JavaScript/TypeScript
-    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
-    uses: ./.github/workflows/lint-js.yml
-    with:
-      checkout_ref: ${{ github.event.pull_request.head.sha }}
-    permissions:
-      contents: read
-
-  lint-rust:
-    name: Lint Rust
-    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
-    uses: ./.github/workflows/lint-rs.yml
-    with:
-      checkout_ref: ${{ github.event.pull_request.head.sha }}
-    permissions:
-      contents: read
-
-  codeql:
-    name: CodeQL
-    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
-    uses: ./.github/workflows/codeql.yml
-    with:
-      checkout_ref: ${{ github.event.pull_request.head.sha }}
-    permissions:
-      security-events: write
-      contents: read
-      packages: read
-      actions: read
-
-  spellcheck:
-    name: Spell Check
-    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
-    uses: ./.github/workflows/spellcheck.yml
-    with:
-      checkout_ref: ${{ github.event.pull_request.head.sha }}
-    permissions:
-      contents: read
-
   dependabot-automerge:
     name: Dependabot Automerge
     if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
-    needs: [security-scan, lint-js, lint-rust, codeql, spellcheck]
     runs-on: ubuntu-latest
+    # Never execute pull-request code in this privileged workflow. Auto-merge
+    # remains gated by the unprivileged PR checks and branch protection.
     steps:
       - name: Dependabot metadata
         id: metadata

.github/workflows/lint-js.yml

@@ -3,13 +3,7 @@
 name: Lint Node.js
 
 on:
-  workflow_call:
-    inputs:
-      checkout_ref:
-        description: Optional commit to check out instead of the triggering ref
-        required: false
-        type: string
-        default: ""
+  workflow_call: {}
   push:
     branches:
       - main
@@ -41,8 +35,6 @@ jobs:
 
       - name: Checkout repository code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
-        with:
-          ref: ${{ inputs.checkout_ref }}
 
       - name: Set up pnpm package manager
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9

.github/workflows/lint-rs.yml

@@ -3,13 +3,7 @@
 name: Lint Rust
 
 on:
-  workflow_call:
-    inputs:
-      checkout_ref:
-        description: Optional commit to check out instead of the triggering ref
-        required: false
-        type: string
-        default: ""
+  workflow_call: {}
   push:
     branches:
       - main
@@ -48,8 +42,6 @@ jobs:
 
       - name: Checkout repository code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
-        with:
-          ref: ${{ inputs.checkout_ref }}
 
       - name: Set up pnpm package manager
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9

.github/workflows/spellcheck.yml

@@ -4,13 +4,7 @@ permissions:
   contents: read
 
 on:
-  workflow_call:
-    inputs:
-      checkout_ref:
-        description: Optional commit to check out instead of the triggering ref
-        required: false
-        type: string
-        default: ""
+  workflow_call: {}
   push:
     branches: ["main"]
   pull_request:
@@ -28,7 +22,5 @@ jobs:
     steps:
       - name: Checkout Actions Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
-        with:
-          ref: ${{ inputs.checkout_ref }}
       - name: Spell Check Repo
         uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 #v1.48.0